1 Like MARK, i.e. set the fwmark, but the mark is calculated from hashing 2 packet selector at choice. You have also to specify the mark range and, 3 optionally, the offset to start from. ICMP error messages are inspected 4 and used to calculate the hashing. 5 .PP 6 Existing options are: 7 .TP 8 \fB\-\-hmark\-tuple\fP tuple\fI\fP 9 Possible tuple members are: 10 .B src 11 meaning source address (IPv4, IPv6 address), 12 .B dst 13 meaning destination address (IPv4, IPv6 address), 14 .B sport 15 meaning source port (TCP, UDP, UDPlite, SCTP, DCCP), 16 .B dport 17 meaning destination port (TCP, UDP, UDPlite, SCTP, DCCP), 18 .B spi 19 meaning Security Parameter Index (AH, ESP), and 20 .B ct 21 meaning the usage of the conntrack tuple instead of the packet selectors. 22 .TP 23 \fB\-\-hmark\-mod\fP \fIvalue (must be > 0)\fP 24 Modulus for hash calculation (to limit the range of possible marks) 25 .TP 26 \fB\-\-hmark\-offset\fP \fIvalue\fP 27 Offset to start marks from. 28 .TP 29 For advanced usage, instead of using \-\-hmark\-tuple, you can specify custom 30 prefixes and masks: 31 .TP 32 \fB\-\-hmark\-src\-prefix\fP \fIcidr\fP 33 The source address mask in CIDR notation. 34 .TP 35 \fB\-\-hmark\-dst\-prefix\fP \fIcidr\fP 36 The destination address mask in CIDR notation. 37 .TP 38 \fB\-\-hmark\-sport\-mask\fP \fIvalue\fP 39 A 16 bit source port mask in hexadecimal. 40 .TP 41 \fB\-\-hmark\-dport\-mask\fP \fIvalue\fP 42 A 16 bit destination port mask in hexadecimal. 43 .TP 44 \fB\-\-hmark\-spi\-mask\fP \fIvalue\fP 45 A 32 bit field with spi mask. 46 .TP 47 \fB\-\-hmark\-proto\-mask\fP \fIvalue\fP 48 An 8 bit field with layer 4 protocol number. 49 .TP 50 \fB\-\-hmark\-rnd\fP \fIvalue\fP 51 A 32 bit random custom value to feed hash calculation. 52 .PP 53 \fIExamples:\fP 54 .PP 55 iptables \-t mangle \-A PREROUTING \-m conntrack \-\-ctstate NEW 56 \-j HMARK \-\-hmark-tuple ct,src,dst,proto \-\-hmark-offset 10000 57 \-\-hmark\-mod 10 \-\-hmark\-rnd 0xfeedcafe 58 .PP 59 iptables \-t mangle \-A PREROUTING -j HMARK \-\-hmark\-offset 10000 60 \-\-hmark-tuple src,dst,proto \-\-hmark-mod 10 \-\-hmark\-rnd 0xdeafbeef 61
